You're right. Blanket rate limits probably aren't a good way to handle the traffic profile of places git services.

Package managers tend to only need a small portion of what's in any given repo; some metadata to figure out what's going on and a single binary package is generally enough. The obvious answer is to separate those out and serve them differently from developers, who are actually monkeying around with the source code.